Vincent Games

Privacy Policy

Last updated 16 October 2026

This site (“Vincent Games”, also called forteensbyteens) is run by nolimedia, a subsidiary of 3DC Enterprises, based in Ireland (“we”, “us”). We are the controller of the personal data described here. This page explains what we collect, why, who else sees it, and what you can do about it.

1. What we collect

Account details. Your email address, a username (it starts as a name taken from your email and you can change it), an optional bio and profile picture, your password (stored only as a salted hash, never in readable form), any passkeys you add (we keep the public key, not your device’s secret), the date you signed up, your role (user or admin), and your video-call preference. Short-lived verification and password-reset tokens are stored as hashes and expire.

Chat. Messages and GIFs you send in the General room or privately are stored on our server together with your account, who they were sent to, and the time. Site admins can read all chat messages, including private ones. Don’t share anything in chat that you want to keep from the people running the site.

Activity. We keep a log of which games you open, when you add a friend, and your chat history, linked to your email. These logs are rolling: when they reach their size limits, the oldest entries are dropped. Whether you are online right now is held in the server’s memory only and clears when the server restarts.

Technical data. Your IP address is used to rate-limit sign-in attempts and stop abuse, and our hosting setup may keep ordinary server logs. Your browser also sends standard details such as browser type and the pages requested.

2. Calls

Voice and video calls are peer-to-peer: the audio and video go directly between the two browsers and do not pass through or get recorded on our server. Our server only passes the connection setup messages and mute / camera-off signals. To connect, browsers use public STUN servers (Google’s by default), which see your IP address, and the person you are calling can see your IP address too. Camera and microphone are only used when you start or answer a call and allow your browser to do so.

3. Analytics and cookies

Essential cookie. arcade_session keeps you signed in for up to 7 days. The site doesn’t work without it.

Google Analytics (Google) measures which pages are used and how, using cookies and your IP address. Microsoft Clarity (Microsoft) records how people use the site: clicks, scrolling, mouse movement and what is shown on the page, including text such as chat messages, so we can replay sessions and see heatmaps. Clarity sets its own cookies. The sign-in, sign-up, password-reset and email-verification pages are masked, and Clarity never records passwords. Both tools also run on the games and on CastleTok, which are part of this site.

You can block or delete these cookies in your browser settings, or use a tracking-protection extension. The site keeps working if you do.

4. Other services that receive data

Some of these providers process data outside the European Economic Area. Where that happens we rely on safeguards such as the EU–US Data Privacy Framework or standard contractual clauses. We do not sell your personal data and we do not use it for advertising.

5. Games

Games on this site are community-submitted and run inside the page. They are not controlled by this policy beyond what is described here, and a game could do things we haven’t anticipated. Report any game that looks unsafe.

6. Why we use your data

7. How long we keep it

Account data is kept until the account is deleted. Chat history and the activity log are kept on a rolling basis until older entries are pushed out by the size limits, or until an admin or you ask for them to be removed. Sign-in sessions last up to 7 days, reset links expire after an hour, and sign-ups that are never verified can be replaced. Google Analytics and Clarity keep data under their own retention settings.

8. Who can see your data

Site admins can see account details, chat messages and the activity log. Other users see your username, profile picture, bio, online status and whatever you send them. We don’t share your data with anyone else except the services in sections 3 and 4, or where the law requires it.

9. Security

Passwords are hashed, the session cookie is HTTP-only, the whole site sits behind a sign-in wall, and sign-in attempts are rate limited. No system is perfectly secure, so please use a strong, unique password.

10. Your rights

Under the GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent you can withdraw it at any time. To use any of these, or to have your account deleted, contact the site administrator. We will reply within one month. You can also complain to the Irish Data Protection Commission at dataprotection.ie.

11. Young people

Sign-up is limited to approved email addresses, for example a school address. If you are under 16, ask a parent, guardian or teacher before creating an account. A parent or guardian can contact us at any time to ask what we hold about their child or to have the account deleted.

12. Changes

If we change this policy we will update the date at the top, and for significant changes we will tell signed-in users with an announcement.

13. Contact

nolimedia, a subsidiary of 3DC Enterprises, Ireland. Questions about this policy or your data: the site administrator.